ip link
the link under the addressip link works one layer below ip addr: it deals with the interface as a device — whether it is enabled, whether it has carrier, how large a frame it will send. It is also how virtual links are made: VLANs, bridges and veth pairs are all created here.
Before asking whether a host has the right address, ask whether the link is up at all.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
lo has no physical carrier to detect, so its operational state is never "UP". The flags still show it enabled and working.
The kernel has carrier and the interface can pass frames. This is the column to read when a host "has no network".
The administrator turned wlan0 on — UP is in the flags — but it is not associated to anything. The fault is the link, not the configuration.
eth0.20 is an 802.1Q sub-interface riding on eth0: frames it sends leave eth0 tagged with VLAN 20. It shares the parent's MAC.
Switches
A switch changes how the command behaves. These are the ones used day to day; man ip lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-br- Brief: one line per interface — name, state and MAC address.
-s- Add statistics: packets, bytes, errors and drops.
-d- Details: show the kind of device — bridge, VLAN, bond — and its settings.
-c- Colour the output.
-j- Print JSON, for scripts.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
ip link set eth0 upEnables the interface. "down" disables it — and drops your SSH session if that is how you got in.
ip link set eth0 mtu 9000Raises the MTU for jumbo frames. Every device on the segment has to agree, or large packets vanish.
ip link add link eth0 name eth0.20 type vlan id 20Creates a tagged sub-interface for VLAN 20 on top of eth0.
ip -s link show eth0Adds packet, error and drop counters — the quickest evidence of a bad cable or a duplex mismatch.
In cybersecurity
Link settings decide what the interface will accept off the wire before any firewall rule runs, so they are worth auditing in their own right.
A PROMISC flag means the interface accepts frames addressed to other hosts. Expected during a capture; suspicious otherwise.
"ip link set address" rewrites the MAC in one line. It defeats MAC filtering and can hijack a neighbour's DHCP lease.
A host on a trunk port can create a sub-interface for any VLAN. Keep user ports in access mode so tags are dropped.
Two interfaces enslaved to a bridge join two networks at layer 2, below where most monitoring looks.
Rising RX errors point to a failing cable or optic — and occasionally to a tap that was fitted carelessly.
A wrong MTU fails only for large packets, which looks like a selective block. Check it before blaming a firewall.